AccuWeather shares users’ location data with third-parties

AccuWeather shares iPhone users’ data with third-party advertising company

Security researcher Will Strafach^[1] delivered shocking news for AccuWeather iOS users last week. Their location data was tracked even if their disabled this feature. What is worse, aggregated details are shared with third-party advertising and monetization firm RevealMobile without user’s knowledge and permission.

RevealMobile is a company that helps to boost mobile revenue for app developers. Therefore, aggregated location information allows displaying targeted ads based on user’s location. It means that you might be offered to visit a shop or restaurant that is in your neighborhood.

However, this issue raised the concerns that one of the most popular mobile weather apps might be violating Apple guidelines. Due to these data tracking and sharing activities, the app might be removed from iTunes.

However, the company published an apology a few days after the scandal.^[2] According to the company, they care about users privacy. Thus, they promise never share similar information without asking direct permission. However, it seems it was just beautiful words.

The latest information claims that AccuWeather continues sharing data with advertisers behind users' back.^[3] Indeed, this behavior is unexpected from one of the most popular weather apps.

Location data was sent when the tracking was turned off

After the installation of AccuWeather on iPhone, users are asked to give permission to track their location in order to provide better and more accurate weather forecast. The app asks to access these details even if a person does not use the app:

• precise GPS coordinates,
• Wi-Fi information,
• Bluetooth connection info.

Strafach’s tested the app for 36 hours and discovered that aggregated information was sent 16 times to RevealMobile. Although users can disable location tracking, it might not be a solution. According to the analysis, it might track information even if a user does not allow it:

“If you do not grant AccuWeather access to your GPS information, it will still send your Wi-Fi router name and BSSID, providing RevealMobile access to less precise location information regarding your device’s whereabouts.”

However, once the incident occurred, AccuWeather releases an update for the app that was supposed to improve the behavior of SDK. Long story short, they indeed made a slight change. Now location information is shared with third-parties only if a user allows it.

AccuWeather continues sharing user’s data

Nevertheless, the company made a public statement and released an update for the app;^[4] it seems that situation changed only a little. Despite these promises, researchers continued testing and monitoring app’s behavior.

According to the newest data, AccuWeather continues sharing precise location data with third-party advertisers. The company sends aggregated information to Nexage servers that are owned by Oath. However, this time data is shared only if a user enables location sharing feature.^[5]

Nevertheless, this privacy violation has been discovered only in the iOS version of the app; Android users reacted to this issue too. Users decide to uninstall the app and left bad reviews in Google Play store.

Users are not only concerned about their privacy; they do not want to support the company that sells other users' data to third-parties. These activities simply are immoral and not tolerated.

This recent incident definitely had a negative impact on AccuWeather’s reputation. Though, they haven’t released an official statement about the recent issue yet.